NewDeal Technical Support Document 260

TESTDISK.BAT, CHECKING FLOPPY DISKS

How to use TESTDISK.BAT or DEBUG or SID to analyze a disk and check for bad data or viruses

If you have a floppy disk in your drive, but your NewDeal software keeps reporting that it can't find a formatted disk, you can run TESTDISK.BAT to take a look at the disk's boot sector data

Using TESTDISK.BAT

To run TESTDISK.BAT, make sure the questionable disk is in the drive, change to the directory where you installed your NewDeal software, and type TESTDISK A: (or B:, C:, D:, or E:, depending on which disk you want to look at). TESTDISK depends on DEBUG or SID (the DR-DOS equivalent of DEBUG) being in your path, or otherwise available. If it is not, you will get a "bad command or file name" error.

Using DEBUG or SID

If the you do not have TESTDISK.BAT, you can do the same thing by hand with DEBUG or SID (SID is the DR-DOS equivalent of DEBUG). At the command line, type DEBUG or SID, as appropriate. The DEBUG command prompt is just a little dash, while SID's command prompt is a pound sign. The commands to enter are shown below.

Where X appears, substitute 0 for drive A:, 1 for B:, 2 for C:, 3 for drive D:, or 4 for drive E:. Press <enter> at the end of each line.

These are the commands to enter at the DEBUG prompt

L DS:0 X 0 1 [this loads boot sector data]
D DS:0 3E [this displays the loaded data]
Q [this quits DEBUG]

These are the commands to type at the SID Prompt

NOTE: Do not place any spaces between the commands or SID will fail.
QRDS:0,X,0,1 [loads boot-sector data]
DDS:0,3E [displays boot-sector data]
Q [quits SID]

Analyzing the Results

The results will appear as a 3-line dump of hexadecimal data. These are the first 30h bytes of the boot sector on your disk. The first row of the data dump will look like this, with numbers instead of x's:
xxxx:0000 EB 01 90 .... <­ these are the 3 bytes you want.
The first three bytes of the first row of the data dump must be one of these combinations:
EB __ 90
E9 __ __
FA EB __
00 00 00
(Where __ can be any value). Any other combination will not be recognized by NewDeal as a properly formatted disk and may indicate virus infection. Some known viruses:
FA E9 CC was on a disk with the Music bug virus
EA 05 00 the Stoned virus
Note: A proper disk sector does not necessarily mean that a diskette is virus­free! Get a good virus testing program such as McAfee's, Norton's, etc. to make this determination.

The Media Descriptor Byte

In the second row, look for byte 15 (6th from the left).
xxxx:0010 __ __ __ __ __ F9 <­this byte

It is the media descriptor:

The (invalid) media descriptor byte C0 may indicate the Michelangelo virus.
Back to Index
Last Modified 17 Feb 1999